Webserver resource ownership broken

[matze]

An excerpt from the Vagrant log:

$ vagrant provision filter1 2>&1 | tee /tmp/filter1.log | grep err:
==> filter1: err: /Stage[main]/Notificationserver/Exec[fetch_notifications]/returns: change from notrun to 0 failed: hg clone -
-noupdate https://hg.adblockplus.org/notifications /opt/notifications && chown -R nginx /opt/notifications returned 1 instead of one of [0] at /tmp/vagrant-puppet-2/modules-0/notificationserver/manifests/init.pp:21

The access logs for ​https://hg.adblockplus.org/notifications show that the requests during the hg clone where served properly. Thus I first assumed this being yet another ordering issue (the nginx user may not have existed yet when the subsequent chown command was issued), but it turns out to be a bit more complicated:

1. We explicitly operate Nginx as user www-data on all our servers. Thus changing the owner of the repository to user nginx does not seem to make much sense. Furthermore, the only processes I found run by user nginx are the multiplexer.fcgi handlers from module sitescripts.

2. The package provided by the Nginx PPA (#3016) does not create user nginx any more, but relies on root and www-data only. Thus boxes where the former package was not installed before fail to provision due to a missing system user.

The proper fix is quite trivial: let user www-data operate these modules exclusively. The roll-out, however, again requires special caution in form of proper migration resources or manual intervention.
The alternative would be an explicit resource that ensures user nginx is present.

Note that while the latter is not as clean, I still consider it preferable right now: until #3016 is solved, we should not introduce more complexity here. Thus this ticket while result in two separate patch-sets. The first will implement the alternative or quick fix. The second will follow #3016, migrating the resource ownership.

[matze]

The first patch-set has been ​pushed, another one (regarding /var/cache/nginx) is in ​review now.

[matze]

Pushed both:

• ​https://hg.adblockplus.org/infrastructure/rev/8a926c7ebbfd
• ​https://hg.adblockplus.org/infrastructure/rev/7b4dbf89ebfe